From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794636739; b=zak3OMusyvHGLf6n1NZ18JSZaiCPkqc6SUkRCS3KczXGGrt+iQlHK+6WSqBKTqxgRd1Y hjvWZXw1wVKAEhSbPN3R/PMWBQnwObP4fyrXXRLCALj/htVUvpSfELw38dF6dYgCXxa4Y CK77knKvE86bVWfEVN8ZKzjmmL737QSlHiA+QK7o6QU2AkVExXMcuWyS1qaW/XNXB+2vY XbGOTHjpMrHhH1tIFkP01BBhXGA4xRhTvebJIsHHCef4SByVLbCWvndCgOIOz9XPrdb02 CCeb1p+sOJis9+kVYD5t2skAgwaJJSZmAD755oEJlaBMFRbA2UnI2XSkRJRpFF9qlBA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794636739; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=C07fa0kqQBvaKiPRzrpMKpnfvg+3RyDe9dish+8iq+k=; b=SpBVxErT9LbzMbj7d73uHY/OJti9WVzgD8diSIwwWJPOEkDBYLCqNEa0aDOqcEEdVxFL aPVSBjr8pDlWHzKL0w0KRMe6ALsb24DlEQU5jCLr3oEZON7BNXrYsmuNlrfo1G3Nxi+5v GVbSZIoxGxsbDBgiRlKoAjk9n9Fb0zVUYPEbuGSkysjNjIocf5Dfz5Crems/ueUcgQDVw FQKjOQMm1km57BaM3MjYF5PLWaXvwUdwYgdPDzj1eJ1NUktusuRSeyuVRlrUN+JOeuwjW gIsnZcSYl+VmanddQJZTEIIHdtUNe0iek1ku9YTiRwCkay0Fwqg1CTkqGFs4vrExz2w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=fq2XpVio; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B54C4606A327 for ; Sat, 14 Nov 2026 06:12:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=fq2XpVio Received: by smtp.kernel.org (Postfix) with ESMTPSA id 787BF1F000C4; Sat, 14 Nov 2026 06:12:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794636739; bh=C07fa0kqQBvaKiPRzrpMKpnfvg+3RyDe9dish+8iq+k=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fq2XpVioqwiRDOTXABvytj9j46AmqYLzsPrLwlS8rkUU2rEW4apT2/ctao0UStcPC SKT7Thjq60N3dYf+i8s/QTnqFLrCfByesR3jFiORPzXFIPhDZNqJ1W9vXoDEqNp2gQ GrtABbDkAf5/lnhjv88Jc2LFGzi8kWwp6VUrqXi/Hw+XZ+fOB/9i0+vy8B8y3Og/PS pK19tDlVrMraSI+dA21J3Qvex486mUjxBpbL+CvhGdtP7Vv7D6jXolsJg16Rya0NQW J8nvGJCENidwzP17cYtKnCX9Zx8VNGEM6OHzfPk0diiWoFScBXOzYShjLcBFbPhloN gphjpN1wl98vg== From: Sasha Levin To: stable@vger.kernel.org Cc: Chris Mason , "Gregory Price (Meta)" , Muhammad Usama Anjum , Zi Yan , Baolin Wang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.1.y] mm/huge_memory: fix truncate racing with PMD zapping Date: Sat, 14 Nov 2026 01:12:17 -0500 Message-ID: <20261114061201.3202134-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261109201820-failed-6.1-e6a07d29b0a6@kernel.org> References: <20261109201820-failed-6.1-e6a07d29b0a6@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chris Mason [ Upstream commit e6a07d29b0a60f3a4cfe77fe34eeb4b3fb38d6c4 ] zap_huge_pmd_folio() removes the rmap before calling folio_mark_dirty(). If this was the last mapping, truncation can skip unmapping the folio and proceed without waiting for the PMD lock, racing with dirtying. ifs_set_range_dirty() can oops if MADV_DONTNEED races with ftruncate() on XFS, when we get the folio set dirty after it was found to not be mapped anymore. Move folio_mark_dirty() and folio_mark_accessed() before rmap removal, matching the PTE zap path. This keeps the folio mapped while updating its state, so truncation must wait for the page table lock. Fix generated by an LLM and sent by Chris Mason in private. Fixes: fe6cf984939d ("mm/huge_memory: transfer the pmd dirty bit to the folio on zap") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify comment and description ] Reviewed-by: Gregory Price (Meta) Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-13-d6437171ecc3@kernel.org Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Signed-off-by: David Hildenbrand (Arm) [ sashal: adapted folio-based rmap removal to page_remove_rmap() directly in zap_huge_pmd() ] Signed-off-by: Sasha Levin --- mm/huge_memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 5807f276fe228..08ea68bcf7461 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1681,8 +1681,6 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, if (pmd_present(orig_pmd)) { page = pmd_page(orig_pmd); - page_remove_rmap(page, vma, true); - VM_BUG_ON_PAGE(page_mapcount(page) < 0, page); VM_BUG_ON_PAGE(!PageHead(page), page); } else if (thp_migration_supported()) { swp_entry_t entry; @@ -1706,6 +1704,12 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, folio_mark_dirty(page_folio(page)); } + /* Remove the rmap after transferring the dirty bit to the folio. */ + if (pmd_present(orig_pmd)) { + page_remove_rmap(page, vma, true); + VM_BUG_ON_PAGE(page_mapcount(page) < 0, page); + } + spin_unlock(ptl); if (flush_needed) tlb_remove_page_size(tlb, page, HPAGE_PMD_SIZE); -- 2.53.0